doc: Update mail/roundcube and related pacakges to 1.6.17
mail/roundcube
mail/roundcube-plugin-enigma
mail/roundcube-plugin-password
mail/roundcube-plugin-zipdownload
mail/roundcube: update to 1.6.17
1.6.17 (2026-07-05)
* Enigma: Support automatic public key lookup (import) using HKP v1 protocol
(#5314)
* Enigma: Kolab WOAT Support (#8626)
* Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
* Security: Fix various vulnerabilities in the password plugin using
session-injected username
* Security: Fix stored XSS via unescaped attachment MIME type on the
attachment-validation warning page [CVE-2026-54432]
* Security: Fix SSRF bypass via specific local address URLs - two new cases
[5 lines not shown]
Pull up following revision(s) (requested by gson in ticket #371):
usr.sbin/sysinst/run.c: revision 1.17
usr.sbin/sysinst/defs.h: revision 1.98
usr.sbin/sysinst/util.c: revision 1.85
usr.sbin/sysinst/main.c: revision 1.39
Make sysinst intercept kernel console messages using TIOCCONS at all
times, not just when running an external command, and discard those
that occur when not running an external command so that they don't
mess up the display when running sysinst on the console. Fixes
PR install/54932.
nasm: updated to 3.0.2
3.02
Fix build problems on C23 compilers using a pre-C23 version of <stdbool.h> which defines bool as a macro in violation of the C23 specification.
The immediate form of the JMPE instruction (opcode 0F B8) has been changed to an absolute address, as in the Itanium Architecture Software Developer's Manual, version 2.3, Volume 4, page 4:249. Hopefully this won't break whatever virtual environments use JMPE, but it is the closest thing there is to an official specification for this opcode.
Being an absolute address, treat it equivalent to a FAR jump and do not default to 64 bits in 64-bit mode.
That JMPE has apparently been wrong all these years is probably as good of a hint as any how much it has been actually used, but it does have the possibility of breaking virtual environments. In that case, please file a bug report to https://bugs.nasm.us with details about the virtual environment, and we will figure out a suitable solution.
Various build fixes. Fix the documentation not building on MacOS because of the cp utility lacking -u there. Also fix not building generally due to wrong link formatting. Another fix was a typo in compiler.h related to a C++ check.
Corrections to assembling encodings:
Fix CMP allowing LOCK which is illegal.
Correct multiple AVX512 instructions such as VCVTSD2SI, VCVTSD2USI, VCVTSS2SI, VCVTSS2USI, VCVTTSD2SI, VCVTTSD2USI, VCVTTSS2SI, VCVTTSS2USI, VGETEXPSH, VGETMANTSH, MOVDDUP, VMOVDDUP.
[56 lines not shown]
enchant2: update to 2.8.18.
2.8.18 (July 4, 2026)
---------------------
This release fixes compatibility with the latest Vala compiler, version
0.56.19. The problem was Enchant’s fault; the change in behaviour by valac,
of returning different values for some return types when a method
precondition failed, was fine. The Enchant code was allowing these checks to
fail rather than validating arguments. Manual validation has been added for
most arguments, except the “self” argument for “method calls”, which is
usually the argument in first position, e.g. the EnchantBroker pointer
argument to all enchant_broker_* APIs. Applications can call
`g_log_set_always_fatal(G_LOG_LEVEL_CRITICAL)` or equivalent to make these
tests cause an assertion failure; otherwise, critical errors will be logged,
and in some cases a different value will be returned by the API from that
previously returned. I have not changed the major version of the library,
since the return code in such cases was always undocumented: the APIs
require non-NULL pointers.
[24 lines not shown]
mozilla-rootcerts: update to 1.1.20260611.
Add Cybertrust Japan SecureSign Root CA16. r=bwilson
Remove Email Trust bit from TrustAsia Global Root CA G3 and G4. r=bwilson
Remove Entrust Root Certification Authority. r=bwilson
Remove SecureSign Root CA12. r=bwilson
